fixes CORS bug in config/application.rb